Network Data and Infrastructure Analysis GOSI Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   You have identified an IP address (198.51.100.23) that is communicating with a malware sample. You need to determine if this IP is a dedicated server or part of a shared hosting environment. Which data source would be most helpful?

   • AReverse DNS lookup and WHOIS record for the IP address.
   • BGeolocation database lookup for the IP address.
   • CPort scan of the IP address to see which services are running.
   • DSearch engine query for the IP address.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security team wants to discover all externally accessible subdomains of their own organization's primary domain. They want to include subdomains that are not linked from any public page and that may be used for internal tools. Which combination of techniques would be most effective?

   • AWHOIS lookups and reverse IP lookups on the main domain's IP.
   • BCertificate transparency logs and DNS brute-forcing with a large wordlist.
   • CAnalyzing only the DNS A records of the main domain.
   • DSearch engine queries using site: operator and manual browsing of the main website.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   You are performing a penetration test on a client's web application. You need to identify the underlying web application framework (e.g., Django, Rails, ASP.NET) without causing any disruption. Which method is most reliable?

   • ASend a malformed HTTP request to trigger an error page that reveals the framework.
   • BUse a vulnerability scanner to exploit known framework vulnerabilities.
   • CAnalyze HTTP response headers, cookies, and HTML source for framework-specific patterns.
   • DPerform a full port scan to identify all open ports and services.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   You are conducting a subdomain enumeration for a client. You have already used certificate transparency logs and search engines, but you suspect there are internal subdomains that are not publicly indexed. You have a limited number of DNS queries you can make without triggering rate limits. Which technique should you prioritize to maximize discovery?

   • AQuery the DNS TXT records for the domain to find internal subdomains.
   • BUse a search engine to query 'site:target.com -www' to find subdomains.
   • CUse a targeted wordlist of common internal names (e.g., 'dev', 'staging', 'jenkins', 'gitlab') and brute-force only those.
   • DPerform a full brute-force with a large wordlist of thousands of names.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   You are investigating a web server that is behind a content delivery network (CDN). The CDN is masking the origin server's IP address. You need to identify the origin server's IP to determine its hosting provider. Which technique is most likely to reveal the origin IP?

   • AUse a service like Shodan to search for the domain's SSL certificate hash.
   • BSearch historical DNS records for the domain to find A records that predate the CDN.
   • CPerform a reverse IP lookup on the CDN's IP address.
   • DQuery the WHOIS record for the domain to find the hosting provider.
   Reveal Solution Discussion Select an answer first